When ransomware hits a care facility, the question that decides how bad the week will be is simple: can we restore our data without paying? Organizations with clean, tested backups tend to recover on their own timeline. Those without them negotiate under pressure. Backups are not glamorous, but they are the single most practical protection a small healthcare operator can invest in.
The catch is that modern ransomware targets backups on purpose. A backup copy sitting on the same network as the server it protects can be encrypted or deleted in the same attack. Here is how to build backups that survive.
The classic rule is easy to remember.
3 copies of your data: the live version plus two backups
2 different types of storage, such as a local appliance and cloud storage
1 copy off site, away from the building and the network
Many security teams now add a modern twist often written as 3-2-1-1-0: one copy that is offline or immutable, and zero errors when you test the restore.
An immutable backup cannot be changed or deleted for a set period, even by an administrator account. If an attacker steals admin credentials, they still cannot erase the protected copies. Many cloud backup services offer this as a setting.
The account that manages your backups should not be the same one that logs into everyday workstations. Use unique credentials, protect them with multi-factor authentication, and do not join the backup system to the same domain login where it can be avoided.
An offline copy, such as a rotated drive kept off site or a cloud vault with strict access rules, provides a last line of defense.
Backups fail quietly. Someone should receive an alert for every failed or skipped job, and a person should review a summary each week.
Begin with a list of what you could not operate without. For many facilities that includes:
File servers and shared drives with policies, schedules and resident documents
Databases for locally hosted applications
Email and collaboration data, which cloud providers do not automatically back up in the way many assume
Phone system configuration
Network device configurations, so a replacement switch or firewall can be set up quickly
Any system that holds data outside the EMR
If your EMR is hosted by the vendor, such as a cloud-based PointClickCare environment, ask what their backup and recovery commitments are, and keep a plan for downtime documentation in the meantime.
Two questions guide design.
How much data can we afford to lose? If the answer is a day of work, nightly backups may do. If it is an hour, you need more frequent copies.
How long can we be down? A facility can operate on paper for a limited time. Decide how long, and make sure your restore plan fits inside it.
Write these targets down, because they drive cost. Faster recovery requires more investment.
A backup you have never restored is an assumption. Schedule tests at least quarterly.
Restore a single file and confirm it opens
Restore a full server to a test environment once or twice a year
Time the process and record how long it took
Document who does what, with contact numbers that work when email is down
The first test almost always finds something: a folder that was never included, an expired credential, or a restore that takes far longer than expected. It is far better to learn that on a quiet Tuesday.
CMS emergency preparedness requirements for long-term care facilities expect a plan that addresses continuity of operations, including medical records. Your backup and recovery steps should appear in that plan, with downtime procedures for staff when systems are unavailable.
Keeping the only backup on a drive plugged into the server
Relying on file sync services as if they were backups
Never checking job reports
Forgetting to protect backup logins with multi-factor authentication
Not keeping a copy of recovery instructions outside the systems that might be down
UnityCare IT helps healthcare organizations design, monitor and test backup and recovery plans that match their size and budget. If you are not sure whether your backups would hold up after a ransomware event, we can walk through your setup and run a restore test with you.
Call or text: 405-285-3845
New customers: start@unitycareit.com
Existing customers: support@unitycareit.com
Address: UnityCare Technologies, 2524 N Broadway Ste 554, PMB 947974, Edmond, Oklahoma 73034-4172